Cookie Policy

This Cookie Policy explains how Great In Nature ("we", "us", "our") uses cookies and similar storage technologies — including browser localStorage, mobile secure device storage, and app preferences storage — across our website, our web app, and our iOS/Android app, and how you can control them.

What are cookies and similar storage?

Cookies are small pieces of data stored on your device by your browser. We also use similar technologies: browser localStorage, which behaves like a cookie but is stored only in your browser; and, in the mobile app, secure device storage and app-preferences storage, which serve the same purpose without a browser.

Categories we use

We use two categories of storage. Strictly necessary storage is always active — it is required for the site or app to function and cannot be switched off. Analytics storage is optional and only runs after you give consent, and you can withdraw that consent at any time.

On the website and web app

• gin_consent (localStorage) — us — stores your cookie choices — kept for 12 months — Strictly necessary.
• auth_token (localStorage) — us — keeps you signed in between visits — kept until you sign out — Strictly necessary.
• gin.pending_onboarding (localStorage) — us — temporarily holds onboarding answers given before you had an account, so they aren't lost when you sign up — kept until onboarding completes — Strictly necessary.
• Refresh-token cookie (HttpOnly cookie, API domain) — us — keeps your session refreshable without re-entering your password — kept until you sign out or it expires — Strictly necessary.
• Laravel session / XSRF-TOKEN (cookie, API domain) — us — keeps you signed in and protects against cross-site request forgery — kept for the browser session — Strictly necessary.
• ph_phc_…_posthog (cookie/localStorage) — PostHog (EU cloud) — analytics: distinguishes visitors and remembers your session/device id — kept for 12 months — Analytics.
• __ph_opt_in_out_… (cookie) — PostHog — remembers that you opted out — kept for 12 months — Strictly necessary.
• __stripe_mid / __stripe_sid (cookie) — Stripe — payment processing and fraud prevention, set only during checkout — kept 1 year / 30 minutes — Strictly necessary.
• YouTube embed (youtube-nocookie.com) — Google — video playback, only loaded after you click play on an embedded video (a click-to-load facade — nothing loads beforehand, and thumbnails are served from our own servers, not Google's) — duration varies — Analytics/Functional, on interaction only.

In the mobile app

The app does not use browser cookies, but uses equivalent device storage for the same purposes:

• Secure device storage (Keychain on iOS / Keystore on Android) — us — holds your sign-in tokens, encrypted by the operating system — kept until you sign out — Strictly necessary.
• App preferences storage (SharedPreferences / equivalent) — us — stores your cookie/analytics and health-data consent choices — kept for 12 months — Strictly necessary.
• Downloaded video cache — us — stores exercise videos on-device so playback doesn't re-download the same clip — kept until the cache is cleared or the app is uninstalled — Strictly necessary.
• RevenueCat SDK storage — RevenueCat — remembers your subscription/purchase state so entitlements work offline — kept while the app is installed — Strictly necessary.
• PostHog mobile SDK storage — PostHog (EU cloud) — the mobile equivalent of the web analytics cookies above — kept for 12 months — Analytics.

About our analytics

Our analytics provider is PostHog, hosted in the EU. We do not capture your IP address, autocapture is switched off, person profiles are created only for identified (signed-in) users, and we do not run session replay anywhere. No analytics storage or network request happens until you actively consent.

Managing your choices

You can change or withdraw your cookie consent at any time using the "Cookie settings" link in the site footer, or the Privacy & cookies section of your account in the app (both web and mobile). Withdrawing analytics consent stops future tracking and clears any analytics cookies and local storage already set on your device. Health-data consent is managed separately, from the same Privacy & cookies section — see our Privacy Policy.

For more on how we handle your personal data generally, see our Privacy Policy.